Gamaredon and UAC-0226 WinRAR exploitation in Ukrainian organizations

**Gamaredon** activity against Ukrainian government, military, and critical-infrastructure networks has broadened into a wider **WinRAR CVE-2025-8088** exploitation story that also includes **SHADOW-EARTH-066 (UAC-0226)** operations against Ukrainian organizations. The observed intrusion chains begin with malicious archive lures: one uses a booby-trapped xHTML file and **RAR** archive to place a hidden **HTA** file in the Windows Startup folder, while another uses crafted RAR archives with hidden **NTFS Alternate Data Streams** payloads to plant a Startup-folder **LNK**. Follow-on execution spans **fileless VBScript**, hidden storage in **NTFS Alternate Data Streams**, **PowerShell** launched through **cmd.exe**, and in-memory DLL loading, extending the original stealth picture beyond the earlier fileless chain. Available evidence shows long-term espionage access, document theft, and, in the **UAC-0226** chain, browser password and cookie theft through **GIFTEDCROOK**. The Gamaredon-linked activity remained active in January 2026, and related **Earth Dahu** exploitation tied to the same flaw and target set was still active through at least **April 10, 2026**, indicating that exposure persisted well beyond the July 2025 fix. Persistence and movement methods include scheduled tasks, registry changes, **USB** media, network drives, startup persistence, and command-channel techniques ranging from dead-drop resolution on **Telegram** and **Cloudflare** to dedicated command-and-control infrastructure. Defensive priority is to move **WinRAR** to **7.13 or later** and hunt for startup-folder **HTA** or **LNK** artifacts, alternate data streams, suspicious **VBScript** and **PowerShell** activity, unusual archive extraction paths, and related credential-theft or document-collection behavior; available material does not quantify victim counts, and some infections may still require wiping systems when persistence cannot be removed reliably.